PYSEC-2026-1254 Cleanlab Deserialization of Untrusted Data vulnerability

Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded...

Cleanlab Deserialization of Untrusted Data vulnerability

Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded...

Cleanlab security vulnerabilities

Cleanlab is a standard data-centric AI package open-sourced by Cleanlab. A security vulnerability exists in Cleanlab 2.4.0 and prior versions that stems from the presence of deserialization of untrusted data, where a maliciously crafted datalab.pkl file can run arbitrary code on an end-user's...